Paper/Archive/CVE-2025-6305

CVE-2025-6305

code-projects Online Shoe Store — code-projects Online Shoe Store admin_feature.php sql injection

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 41.5.415 × 208.3 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability was found in code-projects Online Shoe Store 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin_feature.php. The manipulation of the argument product_code leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource

Online Shoe Store1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

VulDB (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

writeupvuldb.com/?id.313305 refvuldb.com/?ctiid.313305 writeupvuldb.com/?submit.595760 exploitgithub.com/kali-001/cve/issues/3 refcode-projects.org